AI Coding CLI Agents Compared: Access, Permissions, Sandboxing and Configuration for Five Tools

Terminal coding agents read a repository, edit files and run shell commands with the developer's own access, and each one exposes different controls for what it may do without asking. This page sets out five command line coding agents side by side with identical fields: Amp, Claude Code, Codex CLI, Gemini CLI and OpenCode. It covers who publishes each tool, how it is licensed and installed, how a developer gets access and what it costs, which models it uses, how its permission and sandbox controls work, which instruction and configuration files it reads, and what administrators can enforce. It is written for developers choosing a terminal agent and for the platform and security teams who approve one. Tools are listed alphabetically; order is not a ranking, and the page gives no verdicts. Last checked: 2026-11-15.

This is an independent reference page from NHI Mgmt Group based on public provider documentation; it is not sponsored or endorsed by any provider.

Key takeaways

• Three are open source, two are not. Codex CLI and Gemini CLI carry the Apache License 2.0 and OpenCode the MIT License in their repositories; Claude Code's repository licence states use is subject to Anthropic's Commercial Terms, and Amp states no open-source licence.
• Access routes differ. Claude Code is included in paid Claude plans; Codex CLI is included from ChatGPT Plus upwards or usable with an API key; Gemini CLI is now aimed at Gemini Code Assist Standard and Enterprise licences; Amp has a free Hobby tier and paid tiers; OpenCode connects to many model providers and offers its own OpenCode Go subscription.
• Gemini CLI changed scope in 2026. Its repository and documentation state that free individual access and Google AI Pro and Ultra users moved to Antigravity CLI on 18 June 2026.
• Every tool has rule-based permissions. Amp and OpenCode use allow, ask and deny style rules; Claude Code uses named permission modes plus rules; Codex CLI combines sandbox modes with approval policies; Gemini CLI has approval modes and folder trust.
• OS-level sandboxing is documented for three. Claude Code, Codex CLI and Gemini CLI document operating system sandboxes for shell commands; Amp documents cloud machines (orbs) per thread and a delegate hook for external policy; OpenCode documents permission rules per agent.

What counts as a CLI coding agent on this page?

A CLI coding agent is a program a developer runs in a terminal that takes a natural language task, reads the files in the current project, proposes or makes edits, and runs commands such as tests, builds or Git operations in a loop until the task is done. Most of these tools now also ship editor extensions, desktop apps or cloud runners; this page compares the command line agent and the controls around it. The five tools here are those named in the page title. Other terminal agents exist, including the Kiro CLI (see the Kiro guide), Cursor's CLI (see the Cursor guide) and Antigravity CLI (see the Google Antigravity guide). For the whole market, see the AI Coding Tools Hub; for the difference between an assistant and an autonomous agent, see AI Coding Assistants vs Autonomous Coding Agents.

CLI coding agents at a glance

As of 15 November 2026, from each provider's own documentation, pricing page or repository.

How much do CLI coding agents cost?

Prices as shown on each provider's pricing page on 15 November 2026, in US dollars per month unless stated. Plans and limits change often; record the date whenever you quote one. For prices across all AI coding tools, see the AI Coding Tools Pricing Tracker.

Models each agent uses

For the underlying models and their published scores, see Coding LLMs Compared.

Permissions, approvals and sandboxing

This is where the tools differ most, and where an organisation's approval decision usually rests. Each subsection uses the same three headings: approval model, isolation and enforcement.

Amp

• Approval model: rules under the amp.permissions settings key are checked in order before every tool call, and the first match decides. Actions are allow, ask, reject and delegate --to <program>, where a helper program returns exit code 0 to allow, 1 to ask and 2 to reject. Rules match tool names such as Bash or mcp__* and arguments such as cmd, with * wildcards. If nothing matches, Amp applies built-in defaults (announced 7 August 2025).
• Isolation: Amp documents orbs, cloud machines created per thread with the code, tools and plugins set up; self-hosted orbs and runners are also listed.
• Enforcement: Amp's permissions page shows central decisions through a delegate helper that forwards tool arguments to an Open Policy Agent server. CLI commands are amp permissions edit, add and test.

Claude Code

• Approval model: permission modes set by permissions.defaultMode: default (Manual, reads only without asking), acceptEdits, plan, auto (a separate classifier model reviews actions), dontAsk (anything that would prompt is denied) and bypassPermissions (intended only for isolated containers and VMs). Deny rules apply in every mode, and writes to protected paths such as .git, .claude and .bashrc are never auto-approved outside bypassPermissions.
• Isolation: an OS-level Bash sandbox on macOS, Linux and WSL2, turned on with /sandbox or sandbox.enabled; sandboxed commands get no network access by default, and strict sandbox mode turns off unsandboxed retries.
• Enforcement: managed settings outrank user settings and include permissions.disableAutoMode and permissions.disableBypassPermissionsMode.

Codex CLI

• Approval model: sandbox modes read-only, workspace-write and danger-full-access, combined with approval policies on-request, never or a granular table. The Auto preset is workspace-write with on-request approvals; version-controlled folders get Auto and other folders read-only. The older untrusted policy is retired. An approvals_reviewer setting can route eligible requests to a reviewer agent.
• Isolation: Seatbelt on macOS, bwrap plus seccomp on Linux, MXC on Windows, and the Linux sandbox on WSL2. Network access is off by default, and .git, .agents, .codex and .aws stay read-only inside writable roots.
• Enforcement: managed configuration can restrict allowed_approval_policies, allowed_approvals_reviewers and allowed_web_search_modes, with MDM requirements taking precedence.

Gemini CLI

• Approval model: approval modes default, auto_edit and plan, set by general.defaultApprovalMode; YOLO is available only from the command line (--yolo or --approval-mode=yolo). Folder trust is controlled by security.folderTrust.enabled, with the list in trustedFolders.json.
• Isolation: macOS Seatbelt (default profile permissive-open, with restrictive and strict profiles), Docker or Podman containers (default image ghcr.io/google/gemini-cli:latest), a Windows native sandbox using integrity levels, gVisor (runsc) and experimental LXC on Linux. Enabled with --sandbox, GEMINI_SANDBOX or the tools.sandbox setting.
• Enforcement: system settings files at /etc/gemini-cli/settings.json (Linux), C:\ProgramData\gemini-cli\settings.json (Windows) and /Library/Application Support/GeminiCli/settings.json (macOS), plus system defaults files.

OpenCode

• Approval model: rules with effects allow, ask and deny over actions such as read, edit, shell, webfetch, external_directory and <server>_<tool> for MCP tools; if no rule matches, OpenCode asks. The base policy allows all actions but asks before reading *.env files, and external_directory is allowed by default.
• Isolation: built-in agents carry their own policies: build (default, full access), plan (denies edits except its plan folder and asks before shell commands) and explore (limited to reads, search, shell and web tools).
• Enforcement: rules go in a permissions array in opencode.jsonc, with later rules overriding earlier ones. Central administration is not stated by Anomaly.

Configuration files and where they live

Instruction and configuration files are part of each agent's attack surface, because a cloned repository can carry them. See Coding Agent Configuration File Attacks and how to audit AI coding assistant tokens and config files.

Team, identity and admin controls

• Amp: SAML and OIDC SSO on Teams (a workspace needs at least one paid member); Enterprise adds SCIM sync, spend limits, audit logs and IP allowlisting. The manual lists Thread Visibility, Workspace Entitlements, Allowed Models and Minimal Data Retention among enterprise features, and the pricing page states a zero and minimal data retention policy for all users and workspaces.
• Claude Code: access through Team and Enterprise seats or an Anthropic Console account; managed settings set the default permission mode and can turn off auto and bypass modes for every session.
• Codex CLI: sign in with ChatGPT (Business, Enterprise and Edu workspaces) or an API key; managed configuration restricts approval policies, reviewers and web search modes. OpenTelemetry export is off by default.
• Gemini CLI: Google account sign-in with a Google Cloud project for Code Assist licences, Gemini API key or Vertex AI; system settings files fix configuration on managed machines; privacy.usageStatisticsEnabled defaults to true.
• OpenCode: per-provider sign-in with /connect; configuration in opencode.jsonc at user and project level; opencode pair creates a one-time web connection link that expires in five minutes.

Retention and training-use terms for each provider are compared in the AI Coding Tools Data Retention Tracker; for a head-to-head of two of these tools, see Claude Code vs OpenAI Codex.

How to choose a CLI coding agent: factual criteria

These criteria help match a tool to a requirement. They are not a ranking.

For a structured evaluation with weighted criteria, see the AI Coding Assistant Buyer's Guide. For the browser-based app builders that sit beside these tools, see Vibe Coding Tools Compared, and for agent platforms beyond coding, AI Agent Platforms Compared.

Rolling out a CLI agent safely

1. Pick the access route first: organisation plan, workspace sign-in or API key, so that usage sits under corporate identity rather than personal accounts.
2. Set the starting permission level centrally: Claude Code permissions.defaultMode, Codex managed approval policies, Gemini CLI system settings, Amp permission rules or delegate helper, OpenCode permissions rules.
3. Turn on the sandbox where documented: test builds and tests under the sandbox in a pilot group before wider use, and keep network access off unless a task needs named hosts.
4. Review instruction and MCP files: treat AGENTS.md, CLAUDE.md, GEMINI.md and MCP server entries in cloned repositories as code that needs review.
5. Measure: track the share of developers on the approved tool, the number of sessions run in the most permissive modes (bypassPermissions, danger-full-access, YOLO), MCP servers in use against the allow-list, and credentials found in agent-readable files.
6. Roll back: each tool can be removed from a machine and its managed settings reverted; keep the previous approved tool configured until the pilot completes.

Credentials are the main identity concern for all five tools: an agent with shell access can read environment variables, cloud CLI sessions and token files. See AI Coding Tools and Secrets Sprawl and the AI IDE and Coding Agent Security Guide.

Practitioner checklist

• Record the date and plan whenever you quote a price or limit for any of the five tools.
• Confirm each tool's licence from its repository LICENSE file before approving it under an open-source policy.
• Choose one access route per tool that keeps usage under corporate identity.
• Set the default permission or approval mode centrally and block the most permissive mode outside isolated environments.
• Enable the documented OS sandbox for shell commands where the tool offers one, with network off by default.
• Review AGENTS.md, CLAUDE.md, GEMINI.md and MCP configuration in every repository the agent will open.
• Check Gemini CLI users' licence type: free and Google AI Pro or Ultra users moved to Antigravity CLI on 18 June 2026.
• Re-read each provider's documentation each quarter, since permission names and defaults change.

Standards and references

• Amp: Manual
• Amp: How we think about permissions
• Amp: Pricing
• Anthropic: Claude Code overview
• Anthropic: Claude Code permission modes
• Anthropic: Claude pricing
• Google: Gemini CLI repository
• Google: Gemini CLI sandboxing
• Google: Gemini CLI configuration reference
• Anomaly: OpenCode documentation
• Anomaly: OpenCode permissions
• Anomaly: OpenCode rules
• OpenAI: Codex CLI repository
• OpenAI: Codex agent approvals and security
• OpenAI: Codex pricing

Related NHI Mgmt Group resources: Claude Code guide · OpenAI Codex guide · Gemini CLI and Code Assist guide · AI Coding Tools Hub